{"id":624,"date":"2018-10-17T23:40:44","date_gmt":"2018-10-17T23:40:44","guid":{"rendered":"https:\/\/www.appservgrid.com\/paw92\/?p=624"},"modified":"2018-10-18T14:55:32","modified_gmt":"2018-10-18T14:55:32","slug":"configure-graylog-server-with-puppet-lisenet-com-linux-security","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2018\/10\/17\/configure-graylog-server-with-puppet-lisenet-com-linux-security\/","title":{"rendered":"Configure Graylog Server with Puppet | Lisenet.com :: Linux | Security"},"content":{"rendered":"

We\u2019re going to use Puppet to install and configure a Graylog server.<\/p>\n

This article is part of the Homelab Project with KVM, Katello and Puppet<\/a> series. See here<\/a> (CentOS 7) and here<\/a> (CentOS 6) for blog posts on how to configure a Graylog server manually.<\/p>\n

Homelab<\/h2>\n

We have a CentOS 7 VM installed which we want to configure as a Graylog server:<\/p>\n

syslog.hl.local (10.11.1.14) \u2013 Graylog\/Elasticsearch\/MongoDB with Apache frontend<\/p>\n

SELinux set to enforcing mode.<\/p>\n

See the image below to identify the homelab part this article applies to.<\/p>\n

\"\"<\/p>\n

Configuration with Puppet<\/h2>\n

Puppet master runs on the Katello<\/a> server.<\/p>\n

Puppet Modules<\/h3>\n

We use graylog-graylog<\/a> Puppet module to configure the server. The module only manages Graylog itself. We need other modules to install the required dependencies like Java, MongoDB, Elasticsearch and Apache (as a reverse proxy):<\/p>\n

    \n
  1. puppetlabs-java<\/a><\/li>\n
  2. elastic-elasticsearch<\/a><\/li>\n
  3. puppet-mongodb<\/a><\/li>\n
  4. puppetlabs-apache<\/a><\/li>\n
  5. saz-rsyslog<\/a><\/li>\n<\/ol>\n

    Please see each module\u2019s documentation for features supported and configuration options available.<\/p>\n

    Katello Repositories<\/h3>\n

    Repositories for Graylog, Elasticsearch and MongoDB are provided by Katello (we configured them here<\/a>).<\/p>\n

    Note that Graylog 2.4 does not work with Elasticsearch 6.x, we\u2019ll therefore use Elasticsearch 5.x.<\/p>\n

    Install MongoDB<\/h3>\n

    class { ‘mongodb::globals’:
    \n## Use Katello repository<\/em>
    \nmanage_package_repo => false,
    \n}->
    \nclass { ‘mongodb::server’:
    \nensure => ‘present’,
    \nrestart => true,
    \nbind_ip => [‘127.0.0.1’],
    \nport => 27017,
    \nsmallfiles => true,
    \n}<\/p>\n

    Install Elasticsearch<\/h3>\n

    class { ‘elasticsearch’:
    \nensure => ‘present’,
    \nstatus => ‘enabled’,
    \n## Use Katello repository<\/em>
    \nmanage_repo => false,
    \nrestart_on_change => true,
    \n}->
    \nelasticsearch::instance { ‘graylog’:
    \nconfig => {
    \n‘cluster.name’ => ‘graylog’,
    \n‘network.host’ => ‘127.0.0.1’,
    \n},
    \njvm_options => [
    \n‘-Xms512m’,
    \n‘-Xmx512m’
    \n]
    \n}<\/p>\n

    Install Java and Graylog<\/h3>\n

    include ::java<\/p>\n

    class { ‘graylog::server’:
    \nenable => true,
    \nensure => ‘running’,
    \nconfig => {
    \n‘is_master’ => true,
    \n‘password_secret’ => ‘3jC93bTD…OS7F7H87O’,
    \n‘root_password_sha2’ => ‘008e3a245354b…f0d9913325f26b’,
    \n‘web_enable’ => true,
    \n‘web_listen_uri’ => ‘http:\/\/syslog.hl.local:9000\/’,
    \n‘rest_listen_uri’ => ‘http:\/\/syslog.hl.local:9000\/api\/’,
    \n‘rest_transport_uri’ => ‘http:\/\/syslog.hl.local:9000\/api\/’,
    \n‘root_timezone’ => ‘GMT’,
    \n}
    \n}->
    \n##
    \n## Use a script to automatically create
    \n## UDP Syslog\/GELF inputs via Graylog API.
    \n##<\/em>
    \nfile { ‘\/root\/syslog_inputs.sh’:
    \nensure => file,
    \nsource => ‘puppet:\/\/\/homelab_files\/syslog_inputs.sh’,
    \nowner => ‘0’,
    \ngroup => ‘0’,
    \nmode => ‘0700’,
    \nnotify => Exec[‘create_syslog_inputs’],
    \n}
    \nexec {‘create_syslog_inputs’:
    \ncommand => ‘\/root\/syslog_inputs.sh’,
    \nrefreshonly => true,
    \n}<\/p>\n

    The content of the file syslog_inputs.sh can be seen below.<\/p>\n

    We create two Graylog inputs, one for syslog to bind to UDP 1514, and one for GELF. See the section below for port redirection from UDP 514 to UDP 1514 as Graylog cannot bind to UDP 514 unless run as root.<\/p>\n

    #!\/bin\/bash
    \nGRAYLOG_URL=”http:\/\/admin:    [email protected]<\/a>:9000\/api\/system\/inputs”;<\/p>\n

    GRAYLOG_INPUT_SYSLOG_UDP=’
    \n{
    \n“global”: “true”,
    \n“title”: “Syslog UDP”,
    \n“configuration”: {
    \n“port”: 1514,
    \n“bind_address”: “0.0.0.0”
    \n},
    \n“type”: “org.graylog2.inputs.syslog.udp.SyslogUDPInput”
    \n}’;<\/p>\n

    GRAYLOG_INPUT_GELF_UDP=’
    \n{
    \n“global”: “true”,
    \n“title”: “Gelf UDP”,
    \n“configuration”: {
    \n“port”: 12201,
    \n“bind_address”: “0.0.0.0”
    \n},
    \n“type”: “org.graylog2.inputs.gelf.udp.GELFUDPInput”
    \n}’;<\/p>\n

    curl -s -X POST -H “Content-Type: application\/json” -d “$” $ >\/dev\/null;
    \ncurl -s -X POST -H “Content-Type: application\/json” -d “$” $ >\/dev\/null;<\/p>\n

    exit 0;<\/p>\n

    Configure Firewall<\/h3>\n

    Configure firewall to allow WebUI, syslog and GELF traffic. Also configure port redirection as Graylog cannot bind to UDP 514 unless run as root.<\/p>\n

    firewall { ‘007 allow Graylog HTTP\/S’:
    \ndport => [80, 443, 9000],
    \nsource => ‘10.11.1.0\/24’,
    \nproto => tcp,
    \naction => accept,
    \n}->
    \nfirewall { ‘008 allow Syslog’:
    \ndport => [‘514’, ‘1514’],
    \nsource => ‘10.11.1.0\/24’,
    \nproto => udp,
    \naction => accept,
    \n}->
    \nfirewall { ‘009 redirect Syslog 514 to Graylog 1514’:
    \nchain => ‘PREROUTING’,
    \njump => ‘REDIRECT’,
    \nproto => ‘udp’,
    \ndport => ‘514’,
    \ntoports => ‘1514’,
    \ntable => ‘nat’,
    \n}->
    \nfirewall { ‘010 allow Gelf’:
    \ndport => [‘12201’],
    \nsource => ‘10.11.1.0\/24’,
    \nproto => udp,
    \naction => accept,
    \n}<\/p>\n

    Apache Reverse Proxy with TLS<\/h3>\n

    Install Apache as a reverse proxy for Graylog.<\/p>\n

    class { ‘apache’:
    \ndefault_vhost => false,
    \ndefault_ssl_vhost => false,
    \ndefault_mods => false,
    \nmpm_module => ‘prefork’,
    \nserver_signature => ‘Off’,
    \nserver_tokens => ‘Prod’,
    \ntrace_enable => ‘Off’,
    \n}
    \ninclude apache::mod::proxy
    \ninclude apache::mod::proxy_http
    \ninclude apache::mod::rewrite
    \ninclude apache::mod::ssl
    \ninclude apache::mod::headers<\/p>\n

    apache::vhost { ‘graylog_http’:
    \nport => 80,
    \nservername => ‘syslog.hl.local’,
    \nrewrites => [
    \n{ rewrite_rule => [‘(.*) https:\/\/%%’],
    \nrewrite_cond => [‘% off’],
    \n},
    \n],
    \ndocroot => false,
    \nmanage_docroot => false,
    \nsuphp_engine => ‘off’,
    \n}
    \napache::vhost { ‘graylog_https’:
    \nport => 443,
    \nservername => ‘syslog.hl.local’,
    \ndocroot => false,
    \nmanage_docroot => false,
    \nsuphp_engine => ‘off’,
    \nssl => true,
    \nssl_cert => ‘\/etc\/pki\/tls\/certs\/hl.crt’,
    \nssl_key => ‘\/etc\/pki\/tls\/private\/hl.key’,
    \nssl_protocol => [‘all’, ‘-SSLv2’, ‘-SSLv3’],
    \nssl_cipher => ‘HIGH:!aNULL!MD5:!RC4’,
    \nssl_honorcipherorder => ‘On’,
    \n## Pass a string of custom configuration directives<\/em>
    \ncustom_fragment => ‘
    \nProxyRequests Off
    \n<Proxy *>
    \nRequire ip 10.11.1.0\/24
    \n<\/Proxy>
    \n<Location \/>
    \nRequestHeader set X-Graylog-Server-URL “https:\/\/syslog.hl.local\/api\/”
    \nProxyPass http:\/\/syslog.hl.local:9000\/
    \nProxyPassReverse http:\/\/syslog.hl.local:9000\/
    \n<\/Location>
    \n‘,
    \n}<\/p>\n

    Configure Log Forwarding on All Servers<\/h2>\n

    We want to configure all homelab servers to forward syslog to Graylog.<\/p>\n

    This needs to go in to the main environment manifest file \/etc\/puppetlabs\/code\/environments\/homelab\/manifests\/site.pp so that configuration is applied to all servers.<\/p>\n

    class { ‘rsyslog::client’:
    \nlog_remote => true,
    \nlog_local => true,
    \nremote_servers => false,
    \nserver => ‘syslog.hl.local’,
    \nport => ‘1514’,
    \nremote_type => ‘udp’,
    \nremote_forward_format => ‘RSYSLOG_SyslogProtocol23Format’,
    \n}<\/p>\n

    The result should be something like this:<\/p>\n

    \"\"<\/p>\n

    All servers forward logs to Graylog.<\/p>\n

    Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    We\u2019re going to use Puppet to install and configure a Graylog server. This article is part of the Homelab Project with KVM, Katello and Puppet series. See here (CentOS 7) and here (CentOS 6) for blog posts on how to configure a Graylog server manually. Homelab We have a CentOS 7 VM installed which we … <\/p>\n

    Continue reading “Configure Graylog Server with Puppet | Lisenet.com :: Linux | Security”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-624","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/624","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=624"}],"version-history":[{"count":1,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/624\/revisions"}],"predecessor-version":[{"id":751,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/624\/revisions\/751"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=624"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=624"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=624"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}